Overview

overview

10

Static

static

99ef5cdcc8...eb.exe

windows7-x64

10

99ef5cdcc8...eb.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    145s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29-01-2023 21:28

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    99ef5cdcc8d4101b45c724b59f9cd8c3cad9ca4b224d25fc9701b795b9939ceb.exe

  • Size

    623KB

  • MD5

    7c96849ae4903afd6f8d853458cb1f59

  • SHA1

    961806408c4be9d2d826b0665cba46e86dfc5c6a

  • SHA256

    99ef5cdcc8d4101b45c724b59f9cd8c3cad9ca4b224d25fc9701b795b9939ceb

  • SHA512

    18f33913b76737b302f9ce0d9c6925ab9a0c0c2ab5ef9f6c5b9fa220bbec7e78036c2ba4ccff62c7420e4ef9ba5228f30c163256a2849f16d0690ad5820a02dd

  • SSDEEP

    12288:0JM7K/6xFVdY/r29tDIVmz/Oee0F0q5jGLH6+usB:uXCxFVdY68VE/OX0RFCHa8

Score
10/10
asyncratrat

Malware Config

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers.

    ratasyncrat
  • Executes dropped EXE 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Delays execution with timeout.exe 1 IoCs
    evasion
  • Suspicious behavior: EnumeratesProcesses 23 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\99ef5cdcc8d4101b45c724b59f9cd8c3cad9ca4b224d25fc9701b795b9939ceb.exe
    "C:\Users\Admin\AppData\Local\Temp\99ef5cdcc8d4101b45c724b59f9cd8c3cad9ca4b224d25fc9701b795b9939ceb.exe"
    1⤵
    • Checks computer location settings
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4928
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "System" /tr '"C:\Users\Admin\AppData\Roaming\System.exe"' & exit
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4228
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /create /f /sc onlogon /rl highest /tn "System" /tr '"C:\Users\Admin\AppData\Roaming\System.exe"'
        3⤵
        • Creates scheduled task(s)
        PID:4140
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpF91A.tmp.bat""
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3068
      • C:\Windows\SysWOW64\timeout.exe
        timeout 3
        3⤵
        • Delays execution with timeout.exe
        PID:1484
      • C:\Users\Admin\AppData\Roaming\System.exe
        "C:\Users\Admin\AppData\Roaming\System.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:3128

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\tmpF91A.tmp.bat
    Filesize

    150B

    MD5

    36057d26a708b20d9736fd6317f11f8d

    SHA1

    42e0a68b5c12d9d09704ad3d93a151208cd3921b

    SHA256

    02200ed7ae8e65ecccaa5cabf7c0d331545b5a2c063144e81ee20a31bbd72b2d

    SHA512

    a51beda0e0d2237ac007604caa682d29b5d1f0238b422eba37373511e664d1f616b768d7857ce91874eec1e8cedb5f3d301c0ee31c6768347069932e7432980d

    Download Submit
  • C:\Users\Admin\AppData\Roaming\System.exe
    Filesize

    623KB

    MD5

    7c96849ae4903afd6f8d853458cb1f59

    SHA1

    961806408c4be9d2d826b0665cba46e86dfc5c6a

    SHA256

    99ef5cdcc8d4101b45c724b59f9cd8c3cad9ca4b224d25fc9701b795b9939ceb

    SHA512

    18f33913b76737b302f9ce0d9c6925ab9a0c0c2ab5ef9f6c5b9fa220bbec7e78036c2ba4ccff62c7420e4ef9ba5228f30c163256a2849f16d0690ad5820a02dd

    Download Submit
  • C:\Users\Admin\AppData\Roaming\System.exe
    Filesize

    623KB

    MD5

    7c96849ae4903afd6f8d853458cb1f59

    SHA1

    961806408c4be9d2d826b0665cba46e86dfc5c6a

    SHA256

    99ef5cdcc8d4101b45c724b59f9cd8c3cad9ca4b224d25fc9701b795b9939ceb

    SHA512

    18f33913b76737b302f9ce0d9c6925ab9a0c0c2ab5ef9f6c5b9fa220bbec7e78036c2ba4ccff62c7420e4ef9ba5228f30c163256a2849f16d0690ad5820a02dd

    Download Submit
  • memory/1484-138-0x0000000000000000-mapping.dmp
    Download
  • memory/3068-135-0x0000000000000000-mapping.dmp
    Download
  • memory/3128-139-0x0000000000000000-mapping.dmp
    Download
  • memory/4140-137-0x0000000000000000-mapping.dmp
    Download
  • memory/4228-134-0x0000000000000000-mapping.dmp
    Download
  • memory/4928-132-0x0000000000050000-0x0000000000060000-memory.dmp
    Filesize

    64KB

    Download
  • memory/4928-133-0x0000000004A50000-0x0000000004AEC000-memory.dmp
    Filesize

    624KB

    Download